Vaadin Flow Components possible file bypass via upload validation on the server-side
Priority LOW 38CWE-20Published · Updated
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Code execution
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-434.
Summary
### Description When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the upgrade to a more recent Vaadin version.
Why it matters now
Fix Fixed com.vaadin:vaadin-upload-flow (Maven): 14.13.1, 23.6.2, 24.7.7
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | com.vaadin:vaadin-upload-flow (Maven) | 2.0.0 to before 14.13.1 | 14.13.1 | Patch available | GHSA-94g8-xv23-7656 |
| — | com.vaadin:vaadin-upload-flow (Maven) | 23.0.0 to before 23.6.2 | 23.6.2 | Patch available | GHSA-94g8-xv23-7656 |
| — | com.vaadin:vaadin-upload-flow (Maven) | 24.0.0 to before 24.7.7 | 24.7.7 | Patch available | GHSA-94g8-xv23-7656 |
- com.vaadin:vaadin-upload-flow (Maven) Vendor— Affected 2.0.0 to before 14.13.1 Fixed in 14.13.1 Patch available GHSA-94g8-xv23-7656
- com.vaadin:vaadin-upload-flow (Maven) Vendor— Affected 23.0.0 to before 23.6.2 Fixed in 23.6.2 Patch available GHSA-94g8-xv23-7656
- com.vaadin:vaadin-upload-flow (Maven) Vendor— Affected 24.0.0 to before 24.7.7 Fixed in 24.7.7 Patch available GHSA-94g8-xv23-7656
Remediation
- Fix · GHSA-94g8-xv23-7656 com.vaadin:vaadin-upload-flow (Maven) Fixed in 14.13.1 Advisory →
- Fix · GHSA-94g8-xv23-7656 com.vaadin:vaadin-upload-flow (Maven) Fixed in 23.6.2 Advisory →
- Fix · GHSA-94g8-xv23-7656 com.vaadin:vaadin-upload-flow (Maven) Fixed in 24.7.7 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-94g8-xv23-7656
References
Other 5
- https://github.com/vaadin/flow-components/security/advisories/GHSA-94g8-xv23-7656
- https://github.com/vaadin/flow-components/pull/7616
- https://github.com/vaadin/flow-components/commit/bfe9e507cdcc5d90a2312c8f0162f798a29ba635
- https://github.com/vaadin/flow-components
- https://vaadin.com/security/cve-2025-9467
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences